Privacy Policy
Last updated 10 Oct 2026
This notice explains how 3Pay Global Ltd handles personal data when you use our website, mobile app and admin tools (the Platform). It applies to co-funders, solicitors, claimants, website visitors and our staff users. We are committed to UK GDPR and the Data Protection Act 2018.
1. Who we are
Controller: 3Pay Global Ltd, company number 8615606, 78 York Street, London W1H 1DP. Contact for privacy matters: info@3payglobal.com or +44 (0)20 7692 8977. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
2. What we collect and why
| What | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Account | name, email, phone number, role, password (stored only as a one-way hash), verification status | create and secure your account, send one-time codes | contract |
| Level 2 profile (co-funders) | date of birth, nationality, address, occupation | verify who you are before you can progress | contract; legal obligation |
| Identity and financial checks (Level 3) | photo of ID, proof of address, net-worth and income bands, source-of-funds information, bank details you give us, risk appetite | anti-money-laundering and know-your-customer checks | legal obligation (Money Laundering Regulations 2017) |
| Legal acceptances | terms/NDA version accepted, the name you typed to sign, time and IP address | prove what you agreed and when | contract; legitimate interests |
| Claims data (solicitors, claimants) | SRA number, firm, claim value and summary, merits assessment, documents, claimant name | assess and publish funding applications | contract; legitimate interests |
| Funding and payments | commitments, amounts, locked rates, receipts, payment status and provider references, bank-transfer proofs, refund requests, payout details | take, record and reconcile payments and returns | contract; legal obligation (accounting) |
| Notifications and devices | in-app notifications, push token, device platform and app version | tell you about your account and claims | contract; consent for push |
| Technical and security | IP address, request logs, error logs, staff audit logs, sign-in failures | keep the Platform secure, prevent fraud, investigate problems | legitimate interests |
| Communications | enquiries, support emails, emails/SMS we sent you and delivery status | answer you, prove what we sent | legitimate interests; contract |
| Marketing preferences | whether you opted in to updates | send updates you asked for | consent (withdraw any time) |
Payment details are entered with Apple or Google (in the App Store or Google Play) and never reach our servers. We do not use advertising or analytics trackers (see the Cookie Policy). We do not use your data for automated decisions with legal effect: your Platform level updates automatically when the published requirements are met, and identity-check outcomes are decided by our staff.
3. Where it comes from
From you (forms, uploads, calls), from your solicitor or the claim file (for claimants), from our payment providers (payment status), and from our own systems (logs). Sign-in with Google or Apple gives us your name and email address only.
4. Who we share it with
- Other users, limited: solicitors see the status and progress of their own claims; claimants see the progress of their claim; funders see redacted claim information and, at Level 3, approved confidential documents. No one sees your KYC documents except our compliance staff.
- Service providers (processors) acting on our instructions: Railway (hosting), Backblaze B2 (private file storage, EU region), Resend (email), Plivo (SMS; we may switch to an equivalent provider), Apple (in-app purchases and Sign in with Apple), Google (Google Play purchases and Sign in with Google, if you use it), Expo (delivery of push notifications).
- Professional advisers, auditors and regulators/law enforcement where the law requires or to establish or defend legal claims.
- We do not sell personal data.
5. International transfers
Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum and similar safeguards. Our file storage uses an EU region.
6. How long we keep it
| Data | Kept |
|---|---|
| Account details | until you delete your account, then removed or anonymised straight away |
| Identity (KYC/AML) evidence | 5 years after our relationship ends (legal obligation); access restricted to compliance staff |
| Payments, receipts, commitments, signed agreements | 6 years |
| Staff audit logs | 6 years |
| Email/SMS delivery records | 12 months (message text is not stored in production) |
| One-time codes | deleted shortly after use or expiry |
| Backups | rolled over after at most 14 days, so deleted data disappears from backups within that time |
| We may keep some data longer if needed for a legal claim or investigation. |
7. Security
Data is encrypted in transit; files are stored in private buckets and served only after an authorisation check; passwords are hashed; staff access is role-based, and every privileged action is recorded in an audit log; confidential documents are view-only and each opening is logged; sign-in is rate-limited and temporarily locks after repeated failures. No system is perfectly secure; tell us at once if you suspect misuse of your account.
8. Your rights
You can ask to access, correct, port or erase your data, restrict or object to our use of it, and withdraw consent. You can delete your account yourself (website: Account → Delete account; app: More → Account). Some records must be kept by law (section 6). We reply within one month. To exercise any right, email us; we may need to verify your identity.
9. Children
The Platform is for people aged 18 and over. We do not knowingly collect children’s data.
10. Changes
We will update this notice when our practices change and show the date above; for significant changes we will tell you by email or in the app.